Debian update for xen



Published: 2019-01-16
Risk Low
Patch available YES
Number of vulnerabilities 6
CVE-ID CVE-2018-19961
CVE-2018-19962
CVE-2018-19965
CVE-2018-19966
CVE-2018-19967
CVE-2017-15595
CWE-ID CWE-264
CWE-400
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe 		xen (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 6 vulnerabilities.

1) Denial of service

EUVDB-ID: #VU16002

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19961

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to insufficient TLB flushing after improper large page mappings with AMD IOMMUs. An adjacent attacker can cause the service to crash.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Privilege escalation

EUVDB-ID: #VU16562

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19962

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges on the target system.

The weakness exists on AMD x86 platforms due to small IOMMU mappings are unsafely combined into larger ones. An adjacent attacker can gain host OS privileges.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Denial of service

EUVDB-ID: #VU16005

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19965

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to an error when attempting to use INVPCID with a non-canonical addresses. An adjacent attacker can cause the service to crash.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Denial of service

EUVDB-ID: #VU16006

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19966

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to XSA-240 conflicts with shadow paging. An adjacent attacker can cause the service to crash.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Denial of service

EUVDB-ID: #VU15998

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-19967

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists due to unspecified flaw. An adjacent attacker can invoke a HLE transaction with the XACQUIRE prefix on the host physical memory range covering the first 4 MiB starting at the 1GiB boundary to cause denial of service conditions on the host system.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU9452

Risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-15595

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

Mitigation

Update the affected package to version: 4.8.5+shim4.10.2+xsa282-1+deb9u11.

Vulnerable software versions

xen (Debian package): 4.8.2+xsa245-0+deb9u1 - 4.8.4+xsa273+shim4.10.1+xsa273-1+deb9u10

External links

http://www.debian.org/security/2019/dsa-4369


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###